Google shuttering domain fronting, Signal moving to souqcdn.com

In case it obvious to others: &quot;Domain fronting is a technique that circumvents Internet censorship by hiding the true endpoint of a connection. Working in the application layer, domain fronting allows a user to connect to a blocked service over HTTPS, while appearing to communicate with an entirely different site. [...] This can be done if the blocked and the innocuous sites are both hosted by the same large provider, such as Google App Engine.&#x27; [1]<p>Amazon also recently acquired Souq so wondering if the &#x27;same large provider&#x27; in this case is AWS?<p>[1] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Domain_fronting" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Domain_fronting</a>

Hey, everyone. We spent a decent amount of time at Signal trying to come up with alternatives when we first heard rumors that Google was disabling domain fronting on GAE.<p>We&#x27;re using Souq because it is popular in the countries where we have Censorship Circumvention enabled (Egypt, Oman, Qatar, and UAE) but it would be nice to have other options on CloudFront as well. It&#x27;s possible that we overlooked other highly ranked domains in these countries that use the CloudFront CDN.<p>If anyone has any suggestions, we would appreciate them.

Note that domain fronting is not only usefull to circumvent Internet censorship, it&#x27;s also used by malware.<p>With domain fronting, you can exfiltrate data from a company by making the connection appear to go to a legitimate google service (ex: drive.google.com), whereas it actually is going to a server hosted on google cloud services and controlled by an attacker.

I cannot find a first-party source of why and when Google is shutting down domain fronting, but it makes sense from a cybersecurity perspective. Domain fronting is widely used by malware [1, 2] to evade network-based detection.<p>[1] <a href="https:&#x2F;&#x2F;www.fireeye.com&#x2F;blog&#x2F;threat-research&#x2F;2017&#x2F;03&#x2F;apt29_domain_frontin.html" rel="nofollow">https:&#x2F;&#x2F;www.fireeye.com&#x2F;blog&#x2F;threat-research&#x2F;2017&#x2F;03&#x2F;apt29_d...</a> [2] <a href="https:&#x2F;&#x2F;www.cyberark.com&#x2F;threat-research-blog&#x2F;red-team-insights-https-domain-fronting-google-hosts-using-cobalt-strike&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.cyberark.com&#x2F;threat-research-blog&#x2F;red-team-insig...</a>

Honestly, seems like a crummy move on Google&#x27;s part. They&#x27;re obviously not obligated to keep this running, but it&#x27;s one of the best ways to evade censorship that doesn&#x27;t get blocked. It&#x27;s really a shame.

Can someone share a link to Google talking about shutting this down? I assume they are going to stop allowing appspot (i.e. AppEngine) host headers for google.com requests?

For those wondering what &quot;domain fronting&quot; is,<p><a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Domain_fronting" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Domain_fronting</a> <i>circumvents Internet censorship by hiding the true endpoint of a connection</i>

What are we looking at here?<p>Is this related to Russia blocking a ton of google IPs to enforce the telegram block, or is that a separate thing entirely?

Basics of domain fronting &amp; how it relates to Signal: <a href="https:&#x2F;&#x2F;www.wired.com&#x2F;2016&#x2F;12&#x2F;encryption-app-signal-fights-censorship-clever-workaround&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.wired.com&#x2F;2016&#x2F;12&#x2F;encryption-app-signal-fights-c...</a><p>In-depth explanation of Domain Fronting: <a href="https:&#x2F;&#x2F;www.bamsoftware.com&#x2F;papers&#x2F;fronting&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.bamsoftware.com&#x2F;papers&#x2F;fronting&#x2F;</a>

This will possibly affect the Tor project&#x27;s Meek pluggable transport as well which is used for many bridges.<p><a href="https:&#x2F;&#x2F;www.torproject.org&#x2F;docs&#x2F;pluggable-transports.html.en" rel="nofollow">https:&#x2F;&#x2F;www.torproject.org&#x2F;docs&#x2F;pluggable-transports.html.en</a>

I was reading up on this topic a few days ago and found this to be an interesting introduction:<p><a href="https:&#x2F;&#x2F;medium.com&#x2F;@pmvk&#x2F;domain-fronting-a-technique-used-to-circumvent-internet-censoring-10ef1bb3db84" rel="nofollow">https:&#x2F;&#x2F;medium.com&#x2F;@pmvk&#x2F;domain-fronting-a-technique-used-to...</a>

Is there any sort of product page listing for their CDN solution? I&#x27;ve heard of Souq as an online retailer, but didn&#x27;t know you could have them act as a CDN.

Note: souq.com is based out of Dubai, as is Telegram.